[PPT] - Karl Fosaaen WHO AM I Karl Fosaaen Pen Tester Password Cracker PowerPoint Presentation

SLIDE 1

ADVENTURES IN AZURE PRIVILEGE ESCALATION

Karl Fosaaen

SLIDE 2

2 Confidential & Proprietary

WHO AM I Karl Fosaaen

 Pen Tester  Password Cracker  Social Engineer  Blogger  Cloud Enthusiast  Private Pilot

https://github.com/netspi https://blog.netspi.com/ Twitter - @kfosaaen

SLIDE 3

3 Confidential & Proprietary

INTRODUCTION

 Everyone is moving to the cloud

 Developers  Sys Admins  Pen Testers

 Azure Benefits

 AzureAD

−

Integrated AD users/groups

 One-stop licensing  Easy to integrate

SLIDE 4

4 Confidential & Proprietary

INTRODUCTION

 For the folks at home, this will assume some level of Azure

knowledge, feel free to pause here, watch the following talks, and come back when you’re done

 Primer Talks:

 You Moved to O365, Now What? -

https://www.youtube.com/watch?v=1loGEPn_n7U

 Attacking & Defending the Microsoft Cloud -

https://adsecurity.org/?p=4179

 I’m in your cloud… -

https://media.defcon.org/DEF%20CON%2027/DEF%20CON%2027 %20presentations/DEFCON-27-Dirk-jan-Mollema-Im-in-your- cloud-pwning-your-azure-environment.pdf

 Attacking Azure w/PowerShell -

https://www.youtube.com/watch?v=IdORwgxDpkw

SLIDE 5

5 Confidential & Proprietary

INITIAL ENTRY POINTS

 How to get credentials in the first place

 This talk is about privilege escalation, but first we need access

 Gathered Credentials

 GitHub/PasteBin/etc.

 Guessed Creds

 Summer2019

 How to access Azure

 Azure Portal – portal.azure.com  Azure CLI  PowerShell - AzureRM /AZ CLI / MSOnline

SLIDE 6

6 Confidential & Proprietary

AZURE PERMISSIONS MODEL

 Tenant Level

 Global Admin

 Subscription Level

 Owner  Contributor  Reader

 Special/Custom Roles

 Multi-Level  Service Specific  Application Specific

 Application of Roles

 Subscription/Resource Group/Asset Level

SLIDE 7

7 Confidential & Proprietary

PRIVILEGE ESCALATION

 How to Access/List Your Permissions

 AZ CLI

−

List Roles: az role assignment list

−

List your roles: az role assignment list –assignee YOUR_USERNAME

−

List the Readers: az role assignment list --role reader

−

List the Contributors: az role assignment list --role contributor

−

List the Owners: az role assignment list --role owner

 Azure Portal – Search->Subscriptions

−

Review subscription IAM

 Azure Portal – Search->Azure Active Directory

−

Roles and Administrators

−

Built-in Roles, Global Admins, etc.

SLIDE 8

8 Confidential & Proprietary

PRIVILEGE ESCALATION

General Privilege Overview

 Tenant/Global Admin  Owner  Contributor/Some Contributor Rights  Reader  No Azure Access

SLIDE 9

9 Confidential & Proprietary

PRIVILEGE ESCALATION – NO ACCESS

 No Azure Access

 Portal is available, but there’s nothing there…

−

Common for users without a Subscription

 Positives

 You have valid credentials and can pivot to other services

−

Office365

−

Outlook/SharePoint/Teams/etc.

−

Single Factor Auth Interfaces

−

https://myapps.microsoft.com

 Negatives

 Not that much valuable information available from Azure

SLIDE 10

10 Confidential & Proprietary

PRIVILEGE ESCALATION - READER

 Reader Level Access

 AzureAD Password Guessing with a full list of users

−

Summer2019, Company1, Password2, etc.

SLIDE 11

11 Confidential & Proprietary

PRIVILEGE ESCALATION - READER

 Reading Deployment Parameters

 All Resource Groups, All Deployments  Looking for config templates with Cleartext Credentials/Keys/Etc.

Get-AzureRmResourceGroup | Get-AzureRmResourceGroupDeployment >> ".\Deployments.txt"

SLIDE 12

12 Confidential & Proprietary

PRIVILEGE ESCALATION - READER

 Reading App Services Configurations

 Not enabled for default Reader access

−

Often granted to Developers with Reader access

 Connection Strings for Azure SQL  Pivot into SQL DB

−

AzureSQL – Data Access Only

−

MSSQL on VM/Server – See PowerUpSQL

SLIDE 13

13 Confidential & Proprietary

PRIVILEGE ESCALATION - READER

 Reading App Services Configurations

 Credentials for Deploying Applications

−

Backdoor applications, access source code, etc.

SLIDE 14

14 Confidential & Proprietary

PRIVILEGE ESCALATION - READER

 Reader Level Example

 Guessed external credentials  User has Subscription Reader rights  Deployment parameters expose local admin credential for

domain joined virtual machine

 RDP to VM exposed to available external network  Mimikatz Contributor account from Azure VM machine

SLIDE 15

15 Confidential & Proprietary

PRIVILEGE ESCALATION - CONTRIBUTOR

Contributor Access

SLIDE 16

16 Confidential & Proprietary

PRIVILEGE ESCALATION - CONTRIBUTOR

 Your user has some level of contributor access

 Subscription Level

−

Great!

 Individual Resource Groups

−

Not bad

 Single Resources/Services

−

We’ll see…

SLIDE 17

17 Confidential & Proprietary

PRIVILEGE ESCALATION - CONTRIBUTOR

 Contributor Level Access on Virtual Machines  NT Authority\SYSTEM command execution on VMs  Next Steps

 Use PowerShell commands or the Portal to get data/shells/etc.

from the VMs, pivot from there  Related Blog: https://blog.netspi.com/running-powershell-scripts-on-azure-vms/

SLIDE 18

18 Confidential & Proprietary

PRIVILEGE ESCALATION - CONTRIBUTOR

 Contributor Level Access on Storage Accounts

 List out all of the Containers and Files  Look for config files, passwords, keys

 Next Steps

 Copy off files  Backdoor office documents

SLIDE 19

19 Confidential & Proprietary

PRIVILEGE ESCALATION - CONTRIBUTOR

 Contributor Level Access on Virtual Disks

 Ability to copy a disk off to another Azure VM  Read the disk

−

Hashes, files, etc.

−

See cloudcopy AWS attack (@_StaticFlow_)

https://medium.com/@_StaticFlow_/cloudcopy-stealing-hashes-from-domain-controllers-in-the-cloud- c55747f0913 https://github.com/Static-Flow/CloudCopy

SLIDE 20

20 Confidential & Proprietary

PRIVILEGE ESCALATION - CONTRIBUTOR

 Contributor Level Access to:

 Key Vaults/App Services/Automation Accounts

 Get-AzurePasswords

 Dump Key Vault Entries  App Services (See Reader Slides)  Automation Accounts

−

Frequently set up to run as Contributor Service accounts

−

Sometimes configured with higher level credentials

−

Cleartext credentials can be recovered for stored account “RunAs” creds

−

Automation Account certificate authentication “exportable” via runbooks

SLIDE 21

21 Confidential & Proprietary

PRIVILEGE ESCALATION - CONTRIBUTOR

 Contributor Level Access to Automation Accounts  Runbooks = Funbooks

 Accessing Key Vaults

−

New runbook to export all key vault entries

−

Automation account may have access that you don’t

 Escalating Privileges

−

New runbook to operate as the privileged user

−

Privilege Escalation

−

Owner and/or Tenant Admin

−

Add additional owner or admin rights to your account

 Related Blog: https://blog.netspi.com/azure-automation-accounts-key-stores/

SLIDE 22

22 Confidential & Proprietary

PRIVILEGE ESCALATION - CONTRIBUTOR

 Reader Level Example (Continued)

 Guessed external credentials  User has Subscription Reader rights  Deployment parameters expose local admin credential for

domain joined virtual machine

 RDP to VM exposed to available (internal/external) network  Mimikatz Contributor account from Azure VM machine  Login to Azure with New Account  Contributor Access to Automation Accounts  Get-AzurePasswords used to dump Owner Account Credential

from Automation Accounts stored credentials

SLIDE 23

23 Confidential & Proprietary

PRIVILEGE ESCALATION - OWNER

Owner Access

SLIDE 24

24 Confidential & Proprietary

PRIVILEGE ESCALATION - OWNER

 Owner Level Access

 Escalating up to Global Admin/Tenant Admin  Frequently Owner Accounts are configured with multiple

subscriptions

−

Global admins are kept on their own island (Think Enterprise Admins)

 Pivot to another subscription

−

Lather/Rinse/Repeat until you’ve accessed/”Owned” all subscriptions (effective Tenant Admin)

 Listing available subscriptions

−

az account list --output table

 Switching subscriptions

−

az account set --subscription "My Demos"

SLIDE 25

25 Confidential & Proprietary

PRIVILEGE ESCALATION – TENANT ADMIN

Tenant Admin and Persistence

SLIDE 26

26 Confidential & Proprietary

PRIVILEGE ESCALATION – TENANT ADMIN

 Tenant Admin Access

 You have global admin, now what?  Burn it all down…  Pivot internally

−

Find your way to the internal network

−

Via Azure or other channels

 Persist Access

SLIDE 27

27 Confidential & Proprietary

PERSISTENCE

 Adding Azure AD accounts

 Global Admins and User Admins are usually limited groups

−

Additions to these groups can be noisy

 Slightly quieter…

−

Similar username to company (kfosaaen/karl.fosaaen)

−

Add as a Contributor or Owner for all (important) subscriptions

−

Mimic account attributes of other admins List Subscriptions: az account list | ConvertFrom-Json | ForEach-Object {$_.id} Pipe those IDs into this command: az role assignment create --role Owner --assignee USERNAME_HERE --scope /subscriptions/$id

SLIDE 28

28 Confidential & Proprietary

PERSISTENCE

 Guest access to Tenant

 Using a look-alike email domain (netspi.cloud)  Using vendor email domain (comcast.net)

−

ISP customer email could be perceived as legit vendor domain

 Add appropriate IAM assignments as needed

SLIDE 29

29 Confidential & Proprietary

PERSISTENCE

 Add your own subscription

 Limit access to everyone (minus Global Admins)  Not really practical  Additional costs incurred  Most likely going to work best for malicious attackers

 Quieter Options…

 Create SPN/Automation/Application with excessive privileges

SLIDE 30

30 Confidential & Proprietary

PERSISTENCE



Automation Account Backdoors

 Use existing Automation Accounts (or Create New)

−

Add a runbook

−

Run with the rights for the account (Usually Contributor or more)

−

Add rights to the Automation Account, where needed

 Job examples

−

Create a new AzureAD user

−

Add to Admins Group

−

Use as short term access

−

Automation account is long term access

−

Add existing user back to admins group

−

Run a specific payload on all/some of the VMs

−

Dump current Azure info out to public storage blob

SLIDE 31

31 Confidential & Proprietary

PERSISTENCE

 Using Webhooks

 Your backdoor has been set, set a hook to trigger when you need it  Trigger a run book with a web request  https://s13events.azure-automation.net/webhooks?token=q%2bREDACTEDJQ%3d

 Related Blog:

 To Be Released Next Week

SLIDE 32

32 Confidential & Proprietary

PERSISTENCE

 Using Watchers

 Watch for a specific event (RunBook Runs every x minutes)

−

Check if AzureAD user has been removed

 Run another RunBook

−

Add Azure AD user back

 Double Dead Man’s Switch

−

Two Automation accounts, they watch each other

−

One gets deleted, the other adds it back

https://docs.microsoft.com/en-us/azure/automation/automation-watchers-tutorial

SLIDE 33

33 Confidential & Proprietary

PERSISTENCE

 Slightly “Loud” Options…

 Adding a backdoor to VMs

−

C2 agents

−

Local admin account access

−

Might require opening FW rules (RDP , SSH, etc.)

 Modify build templates to add accounts/software

−

Could be a major state change

SLIDE 34

34 Confidential & Proprietary

Questions?

SLIDE 35

35 Confidential & Proprietary

ADDITIONAL INFO

 MicroBurst GitHub - https://github.com/NetSPI/MicroBurst  NetSPI Blog - https://blog.netspi.com  MicroBurst Specific Blogs:

 https://blog.netspi.com/get-azurepasswords/  https://blog.netspi.com/anonymously-enumerating-azure-file-resources/  https://blog.netspi.com/enumerating-azure-services/  https://blog.netspi.com/running-powershell-scripts-on-azure-vms/

 Twitter - @kfosaaen  SlideShare - http://www.slideshare.net/kfosaaen

SLIDE 36

MINNEAPOLIS | NEW YORK | PORTLAND | DENVER | DALLAS

https://www.netspi.com https://www.facebook.com/netspi @NetSPI https://www.slideshare.net/NetSPI